Splunk Search

How do I write the regex to capture the database name and major version from my sample data?

vinay4444
Explorer

I am struggling with the regex match on the below pattern. I need to capture major version name from below ( DB2 9.7,DB2 10.1 ) . Pretty much first letter till second "." . Any help?

DB2 9.7.10.1
DB2 10.1.4.4
DB2 9.7.600.413
DB2 9.7.9.8

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

View solution in original post

Sebastian2
Path Finder

No look all in:

# To extract the Version like "x.y" only:
/DB2\s(\d+\.\d+).*/i
# To extract the whole thing like "DB2 x.y"
/(DB2\s\d+\.\d+).*/i

I have to add, that I'm not sure if this actually fits 100% into Splunk. If you want to extract a field via props.conf it would be something like this:

EXTRACT-major_version = DB2\s(?P<major_version>\d+\.\d+).*

To use a regex inline in a search it would be

... |rex "DB2\s(?<major_version>\d+\.\d+).*"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Try this:

| rex "DB2(?<version>\s\d+\.\d+)"

it will be non permanent. and only exist for the single search.


Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

  1. http://regexone.com/ - this is a great interactive tutorial
  2. https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
  3. Splunk Regular Expressions - docs are great
  4. Regular Expression Tutorial

vinay4444
Explorer
index=XXXX  | rex field=databaseDbServerVersion "DB2(?\s\d+\.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Just change

"DB2(?<version>\s\d+\.\d+)"

to

"(?<version>DB2\s\d+\.\d+)"

Everything inside of the parenthesis is going to be "captured". Everything outside of the parenthesis is going to be "matched".

0 Karma

sundareshr
Legend

Try this

(\w+\s\d+\.\d+)

vinay4444
Explorer

index=XXXX | rex field=databaseDbServerVersion "DB2(?\s\d+.\d+)" | table version

Thanks version now has correct result 10.1,10.5 etc but is there a way to get DB2 10.1 , DB2 9.7 in version

0 Karma

sundareshr
Legend

(\w+\s\d+\.\d+) will give you exactly what you asked for.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...